s1d3sw1ped/jiggablend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 9 Wiki Activity

.gitea/workflows: Prefer job GITEA_TOKEN #10

Merged
Ghost merged 1 commits from ash/ci-gitea-token-release into master 2026-09-02 10:11:27 -05:00
Conversation 0 Commits 1 Files Changed 1
+5 -1
Ghost commented 2026-09-02 10:03:55 -05:00
Copy Link
Copy Source

What

Point Release Tag at the job built-in secrets.GITEA_TOKEN instead of the legacy secrets.RELEASE_TOKEN PAT. Add job permissions: contents: write, keep GoReleaser, and set GITEA_TOKEN / GITHUB_TOKEN / GORELEASER_FORCE_TOKEN: gitea the same way vulture does.

Why

Long-lived release PATs are policy debt. Job token + contents: write is the Eva/Rex preferred path for GoReleaser on this forge.

Test

  • Diff is workflow-only (no product changes).
  • Confirm RELEASE_TOKEN is gone from .gitea/workflows/release-tag.yaml.
  • Next tag push should publish via GoReleaser using the job token.

Issue: #9

## What Point Release Tag at the job built-in `secrets.GITEA_TOKEN` instead of the legacy `secrets.RELEASE_TOKEN` PAT. Add job `permissions: contents: write`, keep GoReleaser, and set `GITEA_TOKEN` / `GITHUB_TOKEN` / `GORELEASER_FORCE_TOKEN: gitea` the same way vulture does. ## Why Long-lived release PATs are policy debt. Job token + contents: write is the Eva/Rex preferred path for GoReleaser on this forge. ## Test - Diff is workflow-only (no product changes). - Confirm `RELEASE_TOKEN` is gone from `.gitea/workflows/release-tag.yaml`. - Next tag push should publish via GoReleaser using the job token. Issue: https://git.s1d3sw1ped.com/s1d3sw1ped/jiggablend/issues/9
Ghost changed title from ci: Migrate release to job GITEA_TOKEN to .gitea/workflows: Prefer job GITEA_TOKEN 2026-09-02 10:07:42 -05:00
Ghost added 1 commit 2026-09-02 10:09:48 -05:00
.gitea/workflows: Prefer job GITEA_TOKEN
CI / check-and-test (pull_request) Successful in 30s
Details
17685e7de5 
Release Tag was publishing via secrets.RELEASE_TOKEN, a long-lived
PAT. Prefer the job built-in token with contents: write, matching the
vulture GoReleaser path: set GITEA_TOKEN and GITHUB_TOKEN from
secrets.GITEA_TOKEN and force GoReleaser onto the Gitea token.

Link: #9
Ghost force-pushed ash/ci-gitea-token-release from 590e8d9c5f to 17685e7de5 2026-09-02 10:09:48 -05:00 Compare
Ghost merged commit 98d89c3d28 into master 2026-09-02 10:11:27 -05:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
Compat/Breaking
Breaking change that won't be backward compatible
 Kind/Bug
Something is not working
 Kind/Documentation
Documentation changes
 Kind/Enhancement
Improve existing functionality
 Kind/Feature
New functionality
 Kind/Security
This is security issue
 Kind/Testing
Issue or pull request related to testing
Priority
Critical
1
The priority is critical
Priority
High
2
The priority is high
Priority
Low
4
The priority is low
Priority
Medium
3
The priority is medium
Reviewed
Confirmed
1
Issue has been confirmed
Reviewed
Duplicate
2
This issue or pull request already exists
Reviewed
Invalid
3
Invalid issue
Reviewed
Won't Fix
3
This issue won't be fixed
Status
Abandoned
3
Somebody has started to work on this but abandoned work
Status
Blocked
1
Something is blocking this issue or pull request
Status
Need More Info
2
Feedback is required to reproduce issue or to continue work
draft
Draft for review — do not merge without Eva review
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
ash blake eva linus moss pike s1d3sw1ped
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: s1d3sw1ped/jiggablend#10
Delete Branch "ash/ci-gitea-token-release"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?